CVE-2026-115920

ONNX ConvTranspose shape inference can crash on undersized weights

ONNX project · ONNX ConvTranspose shape inference

First documented disclosure · Review checkpoint

Summary

A malformed model can pass checking and terminate the process performing shape inference.

Severity and exploitation evidence

Medium · 6.2/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Undersized weight tensors without an explicit kernel shape led to indexing an empty effective-kernel array.

Conditions required

An application performs shape inference on an attacker-controlled model with the affected ConvTranspose inputs.

Potential impact

Denial of service; no demonstrated confidentiality or integrity impact.

Affected versions and configurations

1.2.1 through versions before 1.22.0.

Fix and mitigation status

1.22.0.

Practical next steps

Upgrade to 1.22.0 or later and isolate untrusted model processing with resource limits.

Operating lesson

Passing the model checker does not guarantee that later inference or materialization is safe.

Evidence and limits

The public May 18 input-validation patch predates October 20 advisory and October 26 CVE publication. The reviewed sources demonstrate a crash, not code execution.

Sources